Allow additional customizations of authentication and request processing

Several changes here:

1. Allows explicit injection of an AuthenticationManager into a Resource Server

2. Allows aligning of user roles with scopes via flag in DefaultOAuth2RequestFactory

3. Allows user to inject OAuth2Request{Factory,Validator}

4. Re-org of top-level provider package to put concrete implementations of
some interfaces in sub-packages.

Fixes gh-161